SQL Injection Vulnerability in ZenTao Project Management Software
CVE-2022-47745

8.8HIGH

Key Information:

Vendor

Easycorp

Status
Zentao
Vendor
CVE Published:
19 January 2023

What is CVE-2022-47745?

ZenTao Project Management Software, specifically versions 16.4 to 18.0.beta1, is vulnerable to SQL injection attacks. This vulnerability allows an attacker to exploit the system after logging in with any user account. By sending specially crafted requests to the 'importNotice' function, malicious actors can manipulate the SQL queries executed by the server. This could result in unauthorized access to sensitive data or compromise the integrity of the database. Organizations using vulnerable versions of ZenTao should immediately assess and address this risk to protect their user data and maintain system security.

References

https://github.com/l3s10n/ZenTaoPMS_SqlInjection
https://github.com/easysoft/zentaopms/issues/106

EPSS Score

15% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.